Surveillance at work: the legal issues of using CCTV

CCTV used to require installation by specialist security engineers, but modern small-scale camera systems can now be rigged up by almost anyone. Pam Loch, managing partner of Loch Employment Law, looks at the legal implications of surveillance cameras in the workplace.

Research in recent years has estimated that the average person in the UK is likely to be caught on CCTV surveillance cameras 70 times a day. In London it is estimated to be much higher.

Inevitably much of this footage is caught in a location that is – for somebody – his or her workplace. CCTV use at work is becoming increasingly controversial, as some feel the motivation behind it has developed from being used to promote safety and security to being used to monitor staff.

The use of body-worn cameras is now emerging within organisations, such as the NHS and the police, principally in the interest of staff safety, but also for use as evidence in court.

Guy’s and St. Thomas’ NHS Foundation Trust recorded 850 assaults on staff between April and September 2016 and, as a preventative measure, it introduced body-worn cameras for security guards.

Logistics companies are also increasingly using “dash cams” in drivers’ cabs or on couriers’ bikes to protect staff and to use potential footage as evidence.

Fly on the wall

Surveillance cameras generate issues around consent from both the public and employees. Can staff be forced to wear a camera or carry a voice recording device? Do patients in the NHS, for example, know they may be filmed?

While the use of CCTV surveillance and the fact that the average person will be caught on CCTV numerous times a day has become the norm, some employers – or individual managers – may fail to be aware of the legal requirements and the codes of practice that are relevant when using surveillance cameras in the workplace.

Legally, employers must meet the requirements on use of data established in the Data Protection Act 1998 (DPA), and the rights of privacy under the Human Rights Act 1998.

In 2012, the Protection of Freedoms Act was passed. Under this Act, a new code of practice regarding surveillance in public spaces was published in 2013. It applies to public authorities, but is also recommended for other organisations.

A surveillance camera commissioner (SCC) was also appointed, with the aim of promoting and monitoring the use of this new code. The Information Commissioner’s Office (ICO) in May 2015 also published its most up-to-date code of practices for surveillance cameras and personal information.

Some key points from the code of practice, and how this relates to employers, include:

• If an employer wishes to use CCTV in the workplace, the ICO must be notified as to why they intend to use it. This is part of the registration process for a data controller under the DPA. An employer cannot then use the information collected for any other reason. For example, if the organisation is using CCTV to monitor crime, it cannot then use it to monitor staff. Employers should, before using surveillance cameras, carry out an impact assessment, decide if alternatives are possible and only go ahead if the use of cameras meets a legitimate aim.
• Staff must be informed that they may be recorded and where cameras are located. To make this undisputable the employer should use clear and visible signs.
• Levels of CCTV surveillance in work must be proportionate to the reasonable expectation of privacy. In certain areas with a higher level of expected privacy, such as near toilets, changing rooms, kitchen and break areas, it is unlikely to be acceptable to have cameras.

Employers should plan the collection and storage of this data in accordance with the DPA, particularly in regard to how it will be stored, for how long and who can see it.

Subject access requests

Maintaining integrity in these areas is essential. Employers need to be aware that staff can request to see the recordings kept of them by making a subject access request, and the data must be provided no longer than 40 days after a request is received.

The use of CCTV to monitor secretly will not automatically be admissible as evidence in court or in an employment tribunal. A judge will take into account all the circumstances, including whether or not there was a breach of privacy in obtaining the evidence.

Employers should have a written policy covering the use of CCTV in the workplace. This will not only reduce the employer’s risk of successful claims for breach of privacy, but could also make it easier to rely on CCTV evidence in defending employment tribunal claims.